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Claim Amendments : 

1 . (Currently amended) A computer controlled method of analyzing a network, 
wherein the network has a plurality of network segments, the method comprising: 

identifying segment addresses of virtual private network segments in the network, 
wherein pairs of segment addresses define individual virtual private network 
segments; 

obtaining statistical data associated with each identified segment address in the 
networ k, the statistical data representing more than o ne type of statistic 
obtained from each identified segment address : and 

analyzing the obtained statistical data to identify similar statistical data 
corresponding to the pairs of segment addresses. 

2. (Original) The method of claim 1 , wherein the step of analyzing the obtained 
statistical data further comprises the steps of. 

identifying potential pairs of segment addresses; 

obtaining refined statistical data associated with the identified potential pairs of 
segment addresses; and 

confirming that the potential pairs of segment addresses are the pairs of segment 
addresses based on the obtained refined statistical data. 

3. (Original) The method of claim 1 , further comprising the step of storing the 
pairs of segment addresses in a database. 

4. (Currently amended) The method of claim 1 , wherein the step of obtaining 
statistical data associated with each identified segment address in the network, further 
comprises the step of creating a_statistical fingerprint for each identified segment address. 
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5. (Original) The method of claim 4, wherein each statistical fingerprint 
comprises inverse pairs of statistics. 

6. (Original) The method of claim 4, wherein the step of creating statistical 
fingerprints further comprises the step of aggregating a predetermined set of core 
statistics. 

7. (Original) The method of claim 6, wherein the core statistics comprises at 
least one of number of bytes sent/received and number of send/receive errors. 

8. (Original) The method of claim 1, wherein the statistical data comprises at 
least one of number of bytes sent/received and number of send/receive errors. 

9. (Original) The method of claim 1, wherein the step of obtaining statistical 
data associated with each identified segment address further comprising the step of polling 
network devices containing segment addresses during a predetermined interval. 

10. (Original) The method of claim 9, wherein each network device comprises a 

router. 

1 1 . (Original) The method of claim 9, wherein each segment address comprises 
a data link circuit identifier. 

12. (Original) The method of claim 1, wherein each segment address comprises 
a data link circuit identifier. 

13. (Original) A computer-readable medium having computer-executable 
instructions for performing the steps recited in claim 1 . 
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14. (Currently amended) A computer controlled method of analyzing a network, 
wherein the network has a plurality of network segments, the method comprising: 

receiving segment addresses of selected network segments in the network, wherein 
each segment includes at least a portion spanning a public switched network 
and wherein each selected network segment is defined by pairs of segment 
addresses; 

obtaining statistical data associated with each identified segment address in the 

networ k, the statistical data representing differe nt types of statistics: 
analyzing the obtained statistical data to identify similar statistical data; and 
identifying the pairs of segment addresses corresponding to the selected network 
segments, based on the identified similar statistical data. 

1 5. (Currently amended) The method of claim 1 4 further comprising the steps of: 
obtaining refined statistical data associated with the identified pot e ntial pairs of 

segment addresses; and 
confirming that the pot e nt i al pairs of segment addresses are the pairs of segment 

addresses based on the obtained refined statistical data; and 
storing the pairs of segment addresses in a database. 

16. (Currently amended) A method for identifying virtual private network paths, 
comprising the steps of: 

identifying data link connection identifiers of one or more virtual private network 
paths; 

creating a list of unmatched data link connection identifiers; 

polling network devices associated with the datalink connection identifiers for core 

statistics that represent multiple types of statistical data co llected bv the 

network devices : 

creating individual fingerprints for each datalink connection identifier based upon the 
core statistics; 
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matching a fingerprint of each datalink connection identifier with a corresponding 
fingerprint of another datalink connection identifier; and 

identifying one or more virtual private network paths based upon matching 
fingerprints of the datalink connection identifiers. 

17. (Original) The method of claim 16, wherein the step of polling further 
comprises the step of polling the network devices at predetermined intervals. 

18. (Original) The method of claim 16, wherein the step of creating individual 
fingerprints further comprises the step of creating individual fingerprints by utilizing inverse 
pairs of statistics. 

19. (Original) The method of claim 16, wherein the step of matching fingerprints 
further comprises matching core statistics of one end of a data link connection identifier 
with inverse core statistics at another data link connection identifier. 

20. (New) A computer-readable medium containing instructions for controlling a 
computer system to determine connections between devices of a network, by a method 
comprising: 

providing an indication of devices of the network; 

collecting statistical data associated with each device, the statistical data 

representing operation of a device over a time interval; 
identifying devices that are potentially connected based on the collected statistical 

data; and 

confirming that potentially connected devices are connected when a confirming 
collection of statistical data associated with each device over a shorter time 
interval indicates a connection. 



[41826.8822 US01/SL04241 0.009] 5 



Application No.: 09/780,579 



Docket No.: 41826.8822US1 



21. (New) The computer-readable medium of claim 20 wherein the confirming 
collection occurs repeatedly over increasingly shorter time intervals. 

22. (New) The computer-readable medium of claim 21 wherein when a 
confirming collection is inconsistent with potentially connected devices being connected, 
indicating that the potentially connected devices are not connected. 

23. (New) The computer-readable medium of claim 20 wherein the statistical 
data includes the number of bytes sent/received and the number of send/receive errors. 

24. (New) The computer-readable medium of claim 20 wherein the statistical 
data includes the number of send/receive errors. 

25. (New) The computer-readable medium of claim 20 wherein the connections 
are virtual private network paths. 

26. (New) The computer-readable medium of claim 20 wherein the confirming 
accounts for skew in time of collecting the statistical data from different devices. 

27. (New) The computer-readable medium of claim 20 wherein the statistical 
data is collected by polling a device at time interval boundaries. 

28. (New) The computer-readable medium of claim 20 wherein devices are 
potentially connected when their statistical data is within a threshold. 

29. (New) The computer-readable medium of claim 28 including increasing the 
threshold when devices are not identified as potentially connected. 
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30. (New) A computer-readable medium containing instructions for controlling a 
computer system to determine connections between devices of a network, by a method 
comprising: 

providing an indication of devices of the network; 

collecting statistical data associated with each device, the statistical data 

representing at least two types of data; and 
identifying devices that are potentially connected based on the collected statistical 

data. 

31. (New) The computer-readable medium of claim 30 wherein the types of 
statistical data include the number of bytes sent/received and the number of send/receive 
errors. 

32. (New) The computer-readable medium of claim 30 wherein the types of 
statistical data include the number of send/receive errors. 

33. (New) The computer-readable medium of claim 30 including confirming that 
potentially connected devices are connected when a confirming collection of statistical data 
associated with each device indicates a connection. 

34. (New) The computer-readable medium of claim 33 including repeatedly 
performing confirming collections at increasingly shorter time intervals. 

35. (New) The computer-readable medium of claim 34 wherein when a 
confirming collection is inconsistent with potentially connected devices being connected, 
indicating that the potentially connected devices are not connected. 

36. (New) The computer-readable medium of claim 30 wherein the connections 
are virtual private network paths. 
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37. (New) The computer-readable medium of claim 30 wherein devices are 
potentially connected when their statistical data is within a threshold. 

38. (New) The computer-readable medium of claim 37 including increasing the 
threshold when devices are not identified as potentially connected. 
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